[Bccorb]

Closes #111

Adds src/content/docs/understand/security.mdx (served at /understand/security), a security posture and threat model page written for a reviewer answering a security questionnaire. Every factual claim links to code or configuration in seamless-auth-api at the v0.19.1 tag, and each linked path was checked to exist at that tag.

What the page covers

• Trust boundaries: the API trusts its server adapter and service token holders; cookies and CSRF belong to seamless-auth-server.
• Threat model: what it defends against, what it does not, and the accepted risks (lockout discloses existence, pre-auth tokens prove only address possession and are replayable within five minutes, best-effort audit writes, plaintext email and phone, external delivery mode, per-instance limits, the development mode guard override, metadata outage).
• Authentication factors and account lockout.
• Session management: opaque refresh tokens, HMAC fingerprints, rotation with a database-serialised claim, reuse detection, absolute and idle lifetime, concurrent session cap, revocation.
• Cryptography and keys: algorithms per artifact, JWKS signing keys and rotation, secrets that fall back to the service token.
• Audit logging: hash chain, append-only triggers, integrity check, export, retention, write failures.
• Availability and scaling: rate limits, per-instance state, production caveats.
• Vulnerability disclosure, supported versions, and the five published advisories.
• Supply chain: Trivy scan, SBOM and provenance, cosign keyless signing with the verify command, CodeQL gate, npm audit.

The page states that Seamless Auth holds no certification and that FIDO certification is deferred to v1.0.

Not linked yet

• FIDO self-validation results (#396) and the RFC 9700 matrix (docs: RFC 9700 conformance matrix for the inbound OAuth client #117) do not exist yet, so the page does not link them. Links are added when those land.
• Supported versions, the private reporting route and image verification follow docs: refresh SECURITY.md and document container image verification seamless-auth-api#457, and the multi-instance table, lockout and session lifetime follow docs: correct the security posture and document per-instance limits seamless-auth-api#458. Both are still open, so the page links the code at v0.19.1 for those claims rather than the docs on those branches.

Checks

• npx prettier --check .: All matched files use Prettier code style!
• npm run lint: eslint, check-no-h1 and check-sdk-results pass with no output.
• npm run typecheck: Result (13 files): 0 errors, 0 warnings, 0 hints.
• npm run build: 52 page(s) built, Complete! (/understand/security/index.html and /understand/security.md generated).
• npm run check:matrix: fails on main already (13 packages drifted in build/ecosystem.mdx), not touched here.